Local vulnerability

[lukeecart]

HTML injection is possible, Setting a <img src="X" onerror=alert(1);> will show an alert every time you refresh the page...

The created task will need to be sanitised by some package like https://www.npmjs.com/package/sanitize-html or https://github.com/cure53/DOMPurify

[Dharmik48]

Yeah, it is a very serious issue, we need to fix it ASAP!

Would you like to work on this?

[lukeecart]

@Dharmik48 I have created a PR to close this.
I found when escaping the HTML that I was no longer to easily identify tasks. So if it's okay I have added an id to each task and identified by that instead.

[Dharmik48]

@Dharmik48 I have created a PR to close this. I found when escaping the HTML that I was no longer to easily identify tasks. So if it's okay I have added an id to each task and identified by that instead.

Yeah that's totally fine! Having an ID actually makes it better